Astrana Health has disclosed a material cybersecurity incident involving unauthorized access to private and confidential information stored on company servers.
According to a September 23 filing with the U.S. Securities and Exchange Commission, attackers impersonated Astrana Health personnel and spoofed the company’s main telephone number while contacting employees. The social engineering campaign was designed to trick workers into providing access to internal systems.
Attackers Used Phone Spoofing to Target Employees
The incident affected Astrana Health Management, a subsidiary that provides administrative and management services. The attack demonstrates how criminals can bypass technical defenses by manipulating employees and making fraudulent calls appear to originate from a trusted company number.
Astrana’s investigation found that unauthorized individuals accessed or acquired private and confidential data. However, the company is still determining whether the incident exposed patient records, employee information, provider credentials, financial data, intellectual property or other sensitive material.
The total number of affected people has not been disclosed. Astrana said it intends to notify impacted patients and other parties when its investigation determines which information was compromised.
Astrana Health Responds to the Breach
After detecting the unauthorized activity, Astrana Health hired an outside cybersecurity and digital-forensics firm and notified law enforcement, regulators and payer partners.
The company also reset affected credentials, restricted remote-access tools, restored certain systems from clean backups and strengthened its monitoring, logging and threat-detection capabilities. Astrana classified the incident as material on September 22 because of the potentially sensitive nature of the information involved.
Astrana currently does not expect the attack to materially affect its financial condition, but the investigation remains active and the full legal, regulatory and operational impact is unknown.
What Healthcare Organizations Should Learn
Healthcare organizations should treat telephone-based social engineering and caller-ID spoofing as serious security threats. Help-desk teams should independently verify requests involving password resets, account recovery, remote-access software or multifactor authentication changes.
Organizations should also require multiple verification steps for sensitive access requests and train employees to end suspicious calls and contact the alleged requester through a known internal number. Caller ID alone should never be considered proof of identity.
No ransomware or extortion group has been publicly linked to the Astrana Health incident.